4 Answers
4

Seeing as it has just wiped the file I assume the data is still there.

I'm afraid you assume incorrectly. Depending on the filesystem and underlying device, the bytes that once made up the file might still live on disk, but it's going to be inaccessible to anything short of full-on forensic recovery, which I'm certain you don't want to pay for.

Have you checked your temp directory to make sure you don't have another copy laying around? Because you're probably not going to get that particular file back.

If the inode was dereferenced, you might be able to recover the data. If the blocks were overwritten, it will require forensics recovery like Matt identified.

My preferred method is to use debugfs, which can be used to access inodes that have been dereferenced by not yet overwritten. The lsdel command is key. With some simple scripts, you can create hardlinks to all inodes output by lsdel and start groking the data.

Use PhotoRec. There you go. Had a problem once (Linux) where I deleted a partition that was being used as a Physical Volume in an LVM2 Volume Group, and did not have a backup of the /etc/lvm/backup file. PhotoRec solved it neatly, going over the deleted partition and recovering this file (a plain text file) for me, from where I was able to reconstruct the original configuration. Best of luck.

Here's a last resort suggestion - See if you can recover the file the editor had open on the local machine. I've done this before and was able to recover locally without having to try to do so on the server, which is busier and therefore more likely to reuse the disk space the file occupied.